# cve.now: Openzeppelin

The newest entries naming Openzeppelin as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-57583](https://cve.now/CVE-2026-57583.md): OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source (CVSS 3.3)
- [CVE-2026-73645](https://cve.now/CVE-2026-73645.md): OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. (CVSS 6.6)
- [CVE-2026-48054](https://cve.now/CVE-2026-48054.md): OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri (CVSS 8.8)
- [CVE-2025-54070](https://cve.now/CVE-2025-54070.md): OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers (CVSS 6.9)
- [CVE-2024-45304](https://cve.now/CVE-2024-45304.md): OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts (CVSS 5.3)
- [CVE-2024-27094](https://cve.now/CVE-2024-27094.md): OpenZeppelin Contracts base64 encoding may read from potentially dirty memory (CVSS 6.5)
- [CVE-2023-49798](https://cve.now/CVE-2023-49798.md): Duplicated execution of subcalls in OpenZeppelin Contracts (CVSS 5.9)
- [CVE-2023-40014](https://cve.now/CVE-2023-40014.md): OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued \_msgSender (CVSS 5.3)
- [CVE-2023-34459](https://cve.now/CVE-2023-34459.md): OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees (CVSS 5.3)
- [CVE-2023-34234](https://cve.now/CVE-2023-34234.md): Governor proposal creation may be blocked by frontrunning in OpenZeppelin (CVSS 5.3)
- [CVE-2023-30541](https://cve.now/CVE-2023-30541.md): TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts (CVSS 5.3)
- [CVE-2023-30542](https://cve.now/CVE-2023-30542.md): GovernorCompatibilityBravo may trim proposal calldata (CVSS 6.8)
- [CVE-2023-26488](https://cve.now/CVE-2023-26488.md): OpenZeppelin Contracts contains Incorrect Calculation (CVSS 6.5)
- [CVE-2023-23940](https://cve.now/CVE-2023-23940.md): OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass (CVSS 6.4)
- [CVE-2022-39384](https://cve.now/CVE-2022-39384.md): OpenZeppelin Contracts initializer reentrancy may lead to double initialization (CVSS 5.6)
- [CVE-2022-35961](https://cve.now/CVE-2022-35961.md): ECDSA signature malleability in OpenZeppelin Contracts (CVSS 7.9)
- [CVE-2022-35915](https://cve.now/CVE-2022-35915.md): Unbounded gas consumption in @openzeppelin/contracts (CVSS 5.3)
- [CVE-2022-35916](https://cve.now/CVE-2022-35916.md): Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls (CVSS 5.3)
- [CVE-2022-31198](https://cve.now/CVE-2022-31198.md): GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts (CVSS 7.5)
- [CVE-2022-31170](https://cve.now/CVE-2022-31170.md): OpenZeppelin Contracts's ERC165Checker may revert instead of returning false (CVSS 7.5)
- [CVE-2022-31172](https://cve.now/CVE-2022-31172.md): OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers (CVSS 7.5)
- [CVE-2022-31153](https://cve.now/CVE-2022-31153.md): OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli (CVSS 6.5)
- [CVE-2021-41264](https://cve.now/CVE-2021-41264.md): UUPSUpgradeable vulnerability in OpenZeppelin Contracts (CVSS 9.8)
- [CVE-2021-39167](https://cve.now/CVE-2021-39167.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0)
- [CVE-2021-39168](https://cve.now/CVE-2021-39168.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openzeppelin
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.